What’s Vulnerable › Vulnerabilities
CVE-2023-1289
- Severity: medium (CVSS 5.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.9% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2023-03-23 · updated 2026-06-17
- Weakness: CWE-20
Description
A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G.
Affected products
- Fedoraproject Extra Packages For Enterprise Linux: 8.0, 9.0
- Fedoraproject Fedora: 36, 37
- ImageMagick: before 7.1.1-0 — fixed in 7.1.1-0
- Red Hat Enterprise Linux: 8.0, 9.0
How to fix
Upgrade to a fixed version: ImageMagick 7.1.1-0. Check the vendor advisory for mitigations.
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2176858
- https://github.com/ImageMagick/ImageMagick/commit/c5b23cbf2119540725e6dc81f4deb25798ead6a4
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j96m-mjp6-99xr
- https://lists.debian.org/debian-lts-announce/2024/02/msg00007.html
- https://bugzilla.redhat.com/show_bug.cgi?id=2176858
- https://github.com/ImageMagick/ImageMagick/commit/c5b23cbf2119540725e6dc81f4deb25798ead6a4
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j96m-mjp6-99xr
- https://lists.debian.org/debian-lts-announce/2024/02/msg00007.html
Get alerted when CVE-2023-1289 or the next vulnerability affects your stack